Critical MCP Bridge Vulnerability Exposes Ruflo AI Agents to Code Execution and Hijacking
Security researchers disclosed a critical vulnerability in the Ruflo AI platform that allows unauthenticated attackers to execute arbitrary code, hijack AI agents, steal API keys, and poison persistent agent memory through an exposed MCP bridge exposed by default. The flaw affects Ruflo versions prior to 3.16.3 and carries a maximum severity rating of CVSS 10.0.
What happened
A critical vulnerability (CVE-2026-59726, termed RufRoot) in the open-source Ruflo AI agent platform allows unauthenticated attackers to execute arbitrary code through an exposed Model Context Protocol (MCP) bridge with a CVSS score of 10.0, according to research by Noma Security.
The MCP Bridge is an Express.js server that handles every tool invocation made by AI agents, exposing 233 tools covering shell access, database operations, agent management, and memory storage. The /mcp endpoint accepts tool invocations without authentication.
Researchers demonstrated executing commands inside a container, stealing LLM provider API keys from environment variables, deploying attacker-controlled AI agent swarms, retrieving user conversations stored in MongoDB, and inserting malicious entries into Ruflo's AgentDB to poison persistent AI memory.
Reported impact
Attackers could gain unauthenticated access to enterprise AI environments through a single HTTP request, obtaining full control over AI agents and the underlying host infrastructure.
Index analysis
The vulnerability stems from Ruflo's built-in MCP Bridge being exposed by default without authentication, serving as the platform's central control system for every tool call, agent action, and memory operation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.